So the burden of proof is on the defendant here? Shouldn't the state have to prove that he does indeed know the passcode and refuses to reveal it, rather than h

So the burden of proof is on the defendant here? Shouldn't the state have to prove that he does indeed know the passcode and refuses to reveal it, rather than have the defendant prove that he forgot it?